Skills for Real Engineers. Straight from my .agents directory.
39 skills
offensive-iot
Agent skill from
IoT and embedded device security testing methodology. Covers hardware reconnaissance (UART, JTAG, SWD, SPI flash, I2C EEPROM, eMMC chip-off), firmware acquisition (vendor portals, OTA capture, flash dump, binwalk extraction), firmware analysis (filesystem mounting, binary triage, hardcoded secrets, default credential discovery), bootloader attacks (U-Boot console, secure-boot bypass, fault injection), runtime attacks on embedded Linux/RTOS (busybox CVEs, MTD writes, /dev/mem), wireless protocol attacks (Zigbee, BLE, Z-Wave, LoRaWAN, Thread/Matter, sub-GHz), MQTT/CoAP/Modbus/BACnet/OPC-UA exploitation, mobile companion app analysis, cloud-IoT API abuse, and side-channel/glitching basics. Use for IoT pentest, smart-home assessment, ICS/OT testing, or embedded vulnerability research.
How to install offensive-iot
install offensive-iot
# install the Claude-Red pack with the skills CLI
npx skills add SnailSploit/Claude-Red# or add only this skill to Claude Code: copy the folder
Skills/iot/offensive-iot/
# into
~/.claude/skills/offensive-iot/ (all projects)
.claude/skills/offensive-iot/ (one project)
1# IoT & Embedded — Offensive Testing Methodology23## Quick Workflow451. **Recon the device physically** — identify SoC, flash, debug interfaces, radios62. **Get the firmware** — vendor download, OTA capture, hardware dump, or chip-off73. **Unpack and analyze** — filesystems, services, secrets, default creds, vuln components84. **Establish runtime access** — UART shell, telnet/SSH default creds, exploit chain95. **Pivot** — to companion app, cloud API, neighboring devices via mesh / wireless1011---1213## Hardware Reconnaissance1415### PCB Inspection1617- ID the **SoC** by markings (Realtek, Mediatek, Espressif, Broadcom, Allwinner, NXP, STM32, etc.)18- ID **flash** (8-pin SOIC = SPI NOR; BGA = eMMC; TSOP = NAND)19- Find **debug headers**: TX/RX/GND/VCC pads (UART), 4–10 pin (JTAG), 4 pin (SWD)20- Find test points labeled `TX`, `RX`, `TCK`, `TMS`, `TDO`, `TDI`, `RST`, `BOOT`2122### Tools2324| Tool | Use |25|------|-----|26| Multimeter | Identify GND, VCC rails before connecting |27| Logic analyzer (Saleae, DSLogic) | Find UART baud, SPI clock, identify protocols |28| USB-UART (FT232, CP2102) | UART console |29| Bus Pirate / Glasgow | UART, SPI, I2C, JTAG generic |30| J-Link / Black Magic Probe | JTAG / SWD MCU debugging |31| CH341A programmer | Cheap SPI flash dumper |32| XGecu T48 | Modern universal programmer (NAND/eMMC/SPI) |33| ChipQuik / hot-air | Chip-off desolder |3435### UART Discovery3637```bash38# Find baud rate39for b in 9600 19200 38400 57600 115200 230400 460800 921600; do40 echo "=== $b ==="41…
Excerpt shown under the repository's MIT license.
More skills in Claude-Red
Keep exploring
Similar skill repositories
An agentic skills framework & software development methodology that works.
15 skills
Public repository for Agent Skills
20 skills
Makes your AI agent think like the laziest senior dev in the room. The best code is the code you never wrote.
CCCU6 skills
Persistent Context Across Sessions for Every Agent – Captures everything your agent does during sessions, compresses it with AI, and injects relevant context back into future sessions. Works with Claude Code, OpenClaw, Codex, Gemini, Hermes, Copilot, OpenCode + More
CCCXGHGM+135 skills
Production-grade engineering skills for AI coding agents.
CCCXCU25 skills